fix(cli): restore terminal from cbreak mode after run exits - #294

Summary

Fixes #290 — Conductor could leave the invoking terminal in cbreak mode (no echo / no line editing) after a workflow exited, requiring a blind reset or stty sane to recover.

Why this was reworked

An earlier revision of this PR only fixed the SIGTERM cleanup handler (delegating to the previous disposition instead of swallowing the signal, and capturing the disposition into the handler closure to avoid self-recursion). Verified against a real pseudo-terminal, that alone did not fix the issue: the terminal was still left in cbreak after ordinary exits and Ctrl+C, because the two actual root causes were elsewhere. The implementation was therefore reworked around them; the SIGTERM correctness fix is retained as one part of the whole.

Root cause

1. Baseline re-snapshot. KeyboardListener.start() captured the tty settings on every call. Under specific interleavings — a second listener instance in the same process, or a second start() on an already-active listener — the captured "original" settings were the already-broken cbreak state, which stop() then faithfully restored.
2. Post-restore corruption. Provider cleanup could alter terminal settings after listener.stop() had completed, so even a correct restore at the listener level did not guarantee a sane terminal at process exit.

Additionally, the SIGTERM handler swallowed the signal, leaving the process running.

Changes

• Process-global baseline: Capture the tty baseline once per process into a module-level cache before the first tty.setcbreak(); every later listener instance reuses it instead of re-snapshotting the live tty.
• Idempotent start: Make start() idempotent while the listener is truly active (baseline held AND reader thread running), so a duplicate call can't overwrite the baseline or spawn duplicate threads. Start-after-suspend() still restarts correctly.
• Robust restore: Restore with TCSANOW instead of TCSADRAIN so a blocked output drain can't delay the restore.
• Retry capability: Clear the saved baseline only after a successful tcsetattr, so a transient restore failure can be retried by atexit/SIGTERM/stop().
• SIGTERM correctness: The SIGTERM cleanup handler now delegates to the previously-installed disposition after restoring: SIG_DFL resets and re-raises via os.kill, SIG_IGN stays ignored, a callable previous handler is invoked. The previous disposition is captured into the handler closure at registration time to prevent infinite self-recursion.
• Outermost teardown protection: The run and resume commands now reapply and retire the process baseline at their outermost cleanup boundary (after provider shutdown and all other teardown steps, via restore_terminal_baseline(clear=True)). This ensures that even if a provider's cleanup puts the terminal back into cbreak, normal exit, Ctrl+C, and late cleanup failures all return a sane terminal to the shell — and that a later invocation in the same process never applies a stale baseline to a new terminal.

Tests

• New real-pty integration tests (tests/test_interrupt/test_listener_pty.py) reproduce both corruption scenarios on a genuine pseudo-terminal: two listener instances in one process, and double-start() on one instance.
• CLI boundary real-pty tests (tests/test_interrupt/test_cli_terminal_pty.py) verify that provider teardown cannot bypass final TTY restoration, that a later non-interactive run doesn't reuse an old TTY baseline, and that the real CLI restores exact TTY attrs on exit and Ctrl+C.
• New mocked unit tests for the baseline cache, idempotent start, TCSANOW restore paths, restore retry semantics, all SIGTERM delegation cases, and process baseline restoration after listener stop.
• Full suite passes; make lint and make typecheck clean.

Scope

• src/conductor/interrupt/listener.py
• src/conductor/cli/run.py
• Tests in tests/test_interrupt/
• CHANGELOG.md

No behavior change for suspend()/resume() semantics. Windows is unaffected (the listener is already Unix-only).